Privacy Policy

1. Who We Are and Scope

VLOWBAI provides live crowd levels for visitors and occupancy monitoring tools for store owners in the United Arab Emirates. This policy explains what personal data we collect, why we use it, who processes it for us, how long we keep it, and the rights you have under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other applicable laws.

2. Information We Collect

• Account data: your name, email address, account type, and sign-in details handled by Firebase Authentication. Store owners may also give a phone number when registering. It is optional, and we do not verify it.
• Store data: store name, address and map location, capacity, opening hours, store photo, and alert settings.
• Sensor counts: entrance sensors report only how many people entered and left. We store these as totals, such as people inside and hourly and daily counts. The sensors do not use cameras and collect no images, names, or other data that identifies a person.
• Visitor preferences: favorite places and crowd alert settings.
• Support and access requests: messages you send through support tickets or the website access request form, including your name, email, organization, and city.
• AI Chat questions: the questions store owners type into AI Chat. We do not save chat conversations in our database.
• Technical and security data: IP address, browser type, and error reports, used for security, rate limiting, and troubleshooting.
• Billing data: when online payment is available, Stripe handles your card details. We keep only your plan, subscription status, and a Stripe customer reference. We never see your full card number.

3. How We Use Information

• Create and secure your account, and control owner and admin access.
• Show live crowd levels, occupancy, history, alerts, maps, and store insights.
• Answer AI Chat questions and generate AI recommendations for store owners.
• Review access requests, provide support, and send service messages.
• Detect abuse, apply rate limits, investigate errors, and respond to security incidents.
• Manage plans and payments once online payment is available.
• Improve reliability and features. Optional usage analytics run only with your consent.

We do not sell personal data or use it for advertising.

4. Legal Bases

• Contract: to provide the service you signed up for, including your account, store dashboard, and support.
• Consent: for optional analytics and any other processing where we ask for it. You can withdraw consent at any time.
• Legal obligations: to meet tax, accounting, and other legal requirements, and to respond to lawful requests from authorities.
• Security and fraud prevention: to protect the service and its users, where applicable law allows.

5. Sensors and AI Processing

VLOWBAI counts people with entrance flow sensors that detect entries and exits. We do not use cameras, video, or facial recognition, and sensor data contains no personal data. For AI features, we send the store name, store metrics (such as occupancy, entries, and hourly totals), and the owner's question to our AI provider. We do not send your email address, phone number, or payment details. Please do not type personal data into AI Chat.

6. Service Providers

We use the following providers to run VLOWBAI. They process data on our behalf under their contract terms with us.

• Google Firebase and Google Cloud: sign-in, database, file storage for store photos, and optional analytics.
• Vercel: website hosting; processes IP addresses and request logs.
• Microsoft Azure: hosts the message service that receives sensor counts. No personal data is sent to it.
• Stripe: payment processing when online payment is available.
• Sentry: error monitoring. Email addresses, IP addresses, cookies, and sign-in tokens are removed from error reports before they are sent.
• Mapbox: the map on the Explore page. Mapbox receives your IP address and map requests when the map loads.
• OpenAI or Alibaba Cloud (DashScope): AI Chat and AI recommendations. They receive only the store name, store metrics, and the owner's questions.

7. International Transfers

Our providers run data centers outside the UAE, so your data may be stored or processed in other countries, including the United States, the European Union, and Singapore. We rely on our providers' contract terms and security commitments to protect data transferred outside the UAE, as UAE law permits.

8. Retention

• Account, store, and sensor data: kept while your account is active.
• Account deletion: when your account is deleted, we delete your account, owned stores and their sensor history, store photos, support tickets, and notifications. Any remaining copies are removed within 30 days, except records we must keep for legal, security, or fraud-prevention reasons.
• Sensor message records used to avoid counting the same message twice: 7 days.
• Server logs and error reports: kept for the standard periods set by our hosting and monitoring providers, then deleted automatically.
• Website access requests: kept while we review and follow up on the request, and deleted when no longer needed.

9. Your Rights and Choices

• Access: ask for a copy of the personal data we hold about you.
• Correction: update your details in the app, or ask us to correct them.
• Deletion: use Delete Account on the Profile screen, or email us to delete your account, including store owner accounts.
• Objection and consent: object to processing or withdraw consent. To stop optional analytics, choose Necessary Only in the cookie banner or clear this site's data in your browser.
• Complaints: if you are not satisfied with our reply, you can complain to the UAE Data Office.

To make a request, email us from your account email address. We may need to confirm your identity, and we will reply within the time required by law.

10. Cookies and Local Storage

• Essential: a sign-in cookie and Firebase session storage keep you signed in.
• Preferences: your language, theme, and cookie choice are saved in your browser's local storage.
• Offline cache: recent data is cached on your device so the app keeps working on a weak connection.
• Optional analytics: Google Analytics for Firebase runs only if you choose Accept All.

11. Security

We protect data with encrypted HTTPS connections, provider encryption for stored data, Firebase authentication and security rules, server-side permission checks, separate owner and admin roles, rate limiting, and secret keys kept out of our code. No system is perfectly secure, so please also protect your devices and password.

12. Children

VLOWBAI is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this policy as the service changes. We will post the new version on this page with a new "Last updated" date and, for significant changes, let you know in the app or by email.